Definition
A "breach" under HIPAA is the acquisition, access, use, or disclosure of PHI in a manner not permitted by the Privacy Rule which compromises the security or privacy of the PHI. There is a presumption of breach unless you can document, via a 4-factor risk assessment, a low probability of compromise.
The 4-factor risk assessment
- Nature and extent of the PHI involved (types of identifiers, likelihood of re-identification).
- Unauthorised person who used or received the PHI.
- Whether the PHI was actually acquired or viewed.
- Extent to which the risk has been mitigated.
Notification windows
- Affected individuals — without unreasonable delay and no later than 60 calendar days from discovery (first-class mail; email if the individual has agreed).
- HHS Secretary — < 500 individuals: annual report by 60 days after the end of the calendar year. ≥ 500 individuals: contemporaneously with individual notice, via the OCR breach portal.
- Media — ≥ 500 individuals in a single state or jurisdiction: prominent media outlets serving that area.
- Business Associates notify the Covered Entity without unreasonable delay; the contract dictates the exact window (often within 24 hours).
Content requirements
Each notice must describe what happened, types of PHI involved, steps individuals can take, what the entity is doing to investigate/mitigate, and contact procedures.
The iCompaas BA workflow
For Business Associates: when an incident is opened, iCompaas tracks the per-Covered-Entity notification deadlines (as set in each BAA), pre-fills the discovery details and acquired PHI categories from your incident notes, and produces a per-CE notification draft.